Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2024, 01:53 UTC

General

  • Target

    a259f2efb80812c46d9dbc0289929a5973639e8acd4d5a8379a771c3d9fcd98c.exe

  • Size

    167KB

  • MD5

    023a380d41ff5da1d2e505f3028c2733

  • SHA1

    4db196075040aef5e5bcd8aa2e567e4fbd8a59a0

  • SHA256

    a259f2efb80812c46d9dbc0289929a5973639e8acd4d5a8379a771c3d9fcd98c

  • SHA512

    ed474270274370789988e7aea9adfdc9b430882d603f5adee9a5d8efa72fe1c0505dc5c90e60642725c10b640d635b3615f20112913b0d5b6a0ee14db22e1cef

  • SSDEEP

    3072:yxyZgu92s76Mzb9QOosKerONy0w8AJT7GmCMY7pdkW:yxsgu92s7LzVhVrONy0wro

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.normagroup.com.tr
  • Port:
    21
  • Username:
    admins@normagroup.com.tr
  • Password:
    $%M4,p)]vd1=

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a259f2efb80812c46d9dbc0289929a5973639e8acd4d5a8379a771c3d9fcd98c.exe
    "C:\Users\Admin\AppData\Local\Temp\a259f2efb80812c46d9dbc0289929a5973639e8acd4d5a8379a771c3d9fcd98c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2184-13-0x0000000074B40000-0x000000007522E000-memory.dmp

    Filesize

    6.9MB

  • memory/2184-1-0x0000000074B40000-0x000000007522E000-memory.dmp

    Filesize

    6.9MB

  • memory/2184-2-0x0000000000280000-0x00000000002B0000-memory.dmp

    Filesize

    192KB

  • memory/2184-3-0x0000000004070000-0x00000000040B0000-memory.dmp

    Filesize

    256KB

  • memory/2184-4-0x0000000074B40000-0x000000007522E000-memory.dmp

    Filesize

    6.9MB

  • memory/2184-5-0x0000000004070000-0x00000000040B0000-memory.dmp

    Filesize

    256KB

  • memory/2184-0-0x0000000000140000-0x0000000000170000-memory.dmp

    Filesize

    192KB

  • memory/2692-9-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2692-7-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2692-10-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2692-8-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2692-11-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2692-6-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2692-14-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2692-16-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2692-17-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2692-18-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.